VBScript Event Logging: Your First Program Guide

Your First VBScript Program - Integration with System Event Logging

VBScript (Visual Basic Scripting Edition) is a powerful scripting language that can be used to automate tasks in Windows environments. One of its most valuable features is the ability to integrate with system event logging, allowing your scripts to record their activities and provide insights into system behavior. In this comprehensive guide, we'll walk through creating your first VBScript program that leverages event logging to monitor and track system activities.

Understanding VBScript and Event Logging

VBScript is an interpreted scripting language developed by Microsoft that's based on Visual Basic. It's commonly used for system administration tasks, automation, and creating simple applications. One of the key strengths of VBScript is its ability to interact with various Windows components, including the Event Log service.

Event logging in Windows is a centralized system that records important system and application events. These events can range from information messages about successful operations to critical warnings about system failures. By integrating your VBScript programs with the Windows Event Log, you create a reliable mechanism for tracking script execution, troubleshooting issues, and maintaining an audit trail of system activities.

The Windows Event Log consists of several standard log types:

• Application log: Records events from applications
• System log: Records events from Windows system components
• Security log: Records events related to security, such as logon attempts and resource access
• Setup log: Records events during system setup and configuration

Understanding these log types helps you determine where your script events should be recorded based on their purpose and importance.

Setting Up Your First VBScript Program

Before we dive into event logging, let's cover the basics of creating a VBScript program. VBScript files typically have a .vbs extension and can be created using any simple text editor like Notepad, though more advanced editors like Notepad++ or specialized VBScript editors provide additional features like syntax highlighting.

To create your first VBScript program:

1. Open a text editor

2. Save the file with a .vbs extension (e.g., myFirstScript.vbs)

3. Begin with the script declaration (though this is optional in VBScript)

4. Add your code using VBScript syntax

5. Save the file and double-click to run it

Here's a simple "Hello World" VBScript program to get you started:

' This is a comment in VBScript
WScript.Echo "Hello, World!"

When you run this script, a message box will appear displaying "Hello, World!". This demonstrates the basic structure of a VBScript program. Now, let's enhance this script to include event logging functionality.

The LogEvent Method: Your Key to Event Logging

The cornerstone of VBScript's event logging integration is the LogEvent method of the WScript.Shell object. This powerful method enables scripts to write directly to the Windows Event Log, providing a standardized way to record script activities and system states.

To use the LogEvent method, you first need to create an instance of the WScript.Shell object. This can be done using the CreateObject method:

Set objShell = CreateObject("WScript.Shell")

Once you have the WScript.Shell object, you can use its LogEvent method to write entries to the Event Log. The basic syntax of the LogEvent method is:

objShell.LogEvent intType, strMessage [, strTarget]

Where:

• intType specifies the type of event (0 for SUCCESS, 1 for ERROR, 2 for WARNING, etc.)
• strMessage is the text you want to record in the Event Log
• strTarget is optional and specifies the computer name where the event should be logged (default is local system)

The LogEvent method is particularly useful for:

• Tracking script execution status
• Recording errors and warnings
• Monitoring system changes
• Creating audit trails for administrative tasks
• Debugging script issues

Writing Different Types of Events

The Windows Event Log categorizes events using different types, which helps administrators quickly identify the severity and nature of each event. VBScript supports these event types through the intType parameter of the LogEvent method.

The main event types you can use in VBScript are:

• 0 - SUCCESS: Indicates a successful operation or event
• 1 - ERROR: Indicates a significant problem or error
• 2 - WARNING: Indicates a potential problem that might not affect system functionality
• 4 - INFORMATION: Provides general information about an event
• 8 - AUDIT_SUCCESS: Used for security auditing of successful operations
• 16 - AUDIT_FAILURE: Used for security auditing of failed operations

Let's create a practical example that demonstrates how to write different types of events:

Set objShell = CreateObject("WScript.Shell")

' Log a success event
objShell.LogEvent 0, "User profile backup completed successfully"

' Log an error event
objShell.LogEvent 1, "Failed to connect to network share"

' Log a warning event
objShell.LogEvent 2, "Disk space running low (less than 10% available)"

' Log an information event
objShell.LogEvent 4, "System maintenance script started"

' Log audit success event
objShell.LogEvent 8, "User successfully logged in"

' Log audit failure event
objShell.LogEvent 16, "Failed login attempt detected"

When you run this script, each LogEvent call will create an entry in the Windows Event Log with the corresponding event type. You can view these events using the Event Viewer (eventvwr.msc) in Windows.

Practical Applications for System Monitoring

Integrating event logging into your VBScript programs opens up numerous possibilities for system monitoring and administration. Here are some practical applications where event logging can be particularly valuable:

System Health Monitoring

• Track resource usage (CPU, memory, disk space)
• Monitor service status and availability
• Record startup and shutdown events
• Track temperature and hardware status (where available)

Security Auditing

• Log successful and failed login attempts
• Record changes to system configurations
• Track file access and modifications
• Monitor privileged operations

Application Management

• Record installation and uninstallation events
• Track application crashes and errors
• Monitor update and patch deployment
• Log license validation checks

Automated Task Scheduling

• Record task execution status
• Track success and failure rates
• Monitor timing and performance metrics
• Log dependencies and resource conflicts

Here's an example of a monitoring script that checks disk space and logs a warning if space is running low:

Set objShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")

' Get the C: drive
Set objDrive = objFSO.GetDrive("C:")

' Calculate free space percentage
FreeSpace = objDrive.FreeSpace
TotalSpace = objDrive.TotalSpace
FreeSpacePercent = (FreeSpace / TotalSpace) * 100

' Log appropriate event based on available space
If FreeSpacePercent < 10 Then
    objShell.LogEvent 2, "Warning: Low disk space on C: drive. Only " & _
        FormatNumber(FreeSpacePercent, 2) & "% free space available."
ElseIf FreeSpacePercent < 20 Then
    objShell.LogEvent 4, "Information: Disk space on C: drive at " & _
        FormatNumber(FreeSpacePercent, 2) & "% free."
Else
    objShell.LogEvent 0, "Information: Disk space on C: drive is healthy at " & _
        FormatNumber(FreeSpacePercent, 2) & "% free space."
End If

This script checks the free space on the C: drive and logs an appropriate event based on the available space percentage.

Advanced Event Logging Techniques

As you become more comfortable with basic event logging, you can implement more advanced techniques to enhance your scripts' capabilities:

Logging with Custom Event IDs

While the LogEvent method primarily uses predefined event types, you can create more structured logging by incorporating custom event IDs. This helps in categorizing and filtering events more effectively:

Set objShell = CreateObject("WScript.Shell")

' Define custom event IDs for different operations
Const EVENT_ID_BACKUP = 1001
Const EVENT_ID_CLEANUP = 1002
Const EVENT_ID_SYNC = 1003

' Log events with custom IDs
objShell.LogEvent 0, "Daily backup process completed successfully", , EVENT_ID_BACKUP
objShell.LogEvent 4, "Temporary files cleanup completed", , EVENT_ID_CLEANUP
objShell.LogEvent 2, "File synchronization completed with warnings", , EVENT_ID_SYNC

Structured Logging with Timestamps

For more detailed logging, you can include timestamps in your event messages. This helps in tracking when events occurred:

Set objShell = CreateObject("WScript.Shell")

' Get current date and time
dtmNow = Now()
strTimestamp = CStr(dtmNow)

' Log events with timestamps
objShell.LogEvent 0, "System health check completed at " & strTimestamp
objShell.LogEvent 4, "User profile synchronization started at " & strTimestamp
objShell.LogEvent 2, "Performance degradation detected at " & strTimestamp

Conditional Logging

You can implement conditional logging to only record events when specific conditions are met, reducing log noise:

Set objShell = CreateObject("WScript.Shell")
Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")

' Query CPU usage
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_Processor")
For Each objItem in colItems
    CPUUsage = objItem.LoadPercentage
Next

' Only log if CPU usage is above 80%
If CPUUsage > 80 Then
    objShell.LogEvent 2, "High CPU usage detected: " & CPUUsage & "%"
End If

Logging to Remote Event Logs

For centralized logging in enterprise environments, you can write events to remote computers:

Set objShell = CreateObject("WScript.Shell")

' Log to a remote computer
strRemoteComputer = "SERVER01"
objShell.LogEvent 0, "Backup process initiated from local machine", strRemoteComputer

Best Practices and Troubleshooting

When implementing event logging in your VBScript programs, following best practices can ensure reliability and maintainability:

Best Practices

• Use descriptive event messages that clearly explain what happened
• Include timestamps in event messages when necessary
• Use consistent event types for similar operations
• Avoid logging sensitive information in event messages
• Implement proper error handling around LogEvent calls
• Consider performance implications when logging frequent events
• Clean up old events periodically to prevent log files from growing too large

Common Issues and Solutions

• Permission errors: Ensure your script has sufficient permissions to write to the Event Log
• Event log full: Implement checks for available log space and implement log rotation
• Encoding issues: Ensure proper character encoding in event messages, especially for international content
• Event visibility: Check that your events are appearing in the correct log (Application, System, etc.)

Here's an example of a script with proper error handling:

On Error Resume Next

Set objShell = CreateObject("WScript.Shell")

' Attempt to log an event
objShell.LogEvent 0, "System backup process initiated"

' Check for errors
If Err.Number <> 0 Then
    WScript.Echo "Failed to log event: " & Err.Description
    ' Handle the error appropriately (e.g., write to a file, send email notification)
    Err.Clear
Else
    WScript.Echo "Event logged successfully"
End If

On Error GoTo 0

This script demonstrates basic error handling around the LogEvent method, which can help identify and address permission issues or other problems that might prevent successful event logging.

Creating a Comprehensive Monitoring Script

Let's create a more comprehensive monitoring script that demonstrates multiple aspects of event logging integration. This script will check various system components and log appropriate events based on their status:

Option Explicit

' Create objects
Set objShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")

' Main monitoring function
Call SystemHealthCheck()

' Clean up
Set objShell = Nothing
Set objFSO = Nothing
Set objWMIService = Nothing

Sub SystemHealthCheck()
    ' Check disk space
    Call CheckDiskSpace()
    
    ' Check available memory
    Call CheckMemory()
    
    ' Check service status
    Call CheckServices()
    
    ' Log completion
    objShell.LogEvent 0, "System health check completed successfully"
End Sub

Sub CheckDiskSpace()
    On Error Resume Next
    
    ' Get all drives
    Set colDrives = objFSO.Drives
    
    For Each objDrive In colDrives
        If objDrive.IsReady Then
            ' Calculate free space percentage
            FreeSpace = objDrive.FreeSpace
            TotalSpace = objDrive.TotalSize
            FreeSpacePercent = (FreeSpace / TotalSpace) * 100
            
            ' Log appropriate event based on available space
            If FreeSpacePercent < 5 Then
                objShell.LogEvent 1, "Critical: Disk " & objDrive.DriveLetter & " has only " & _
                    FormatNumber(FreeSpacePercent, 2) & "% free space available."
            ElseIf FreeSpacePercent < 10 Then
                objShell.LogEvent 2, "Warning: Disk " & objDrive.DriveLetter & " has only " & _
                    FormatNumber(FreeSpacePercent, 2) & "% free space available."
            Else
                objShell.LogEvent 4, "Information: Disk " & objDrive.DriveLetter & " has " & _
                    FormatNumber(FreeSpacePercent, 2) & "% free space available."
            End If
        End If
    Next
    
    If Err.Number <> 0 Then
        objShell.LogEvent 1, "Error checking disk space: " & Err.Description
        Err.Clear
    End If
    
    On Error GoTo 0
End Sub

Sub CheckMemory()
    On Error Resume Next
    
    ' Query memory information
    Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem")
    For Each objItem In colItems
        TotalMemory = objItem.TotalPhysicalMemory
        AvailableMemory = objItem.FreePhysicalMemory
        MemoryUsagePercent = ((TotalMemory - AvailableMemory) / TotalMemory) * 100
    Next
    
    ' Log appropriate event based on memory usage
    If MemoryUsagePercent > 90 Then
        objShell.LogEvent 1, "Critical: Memory usage is at " & _
            FormatNumber(MemoryUsagePercent, 2) & "%"
    ElseIf MemoryUsagePercent > 80 Then
        objShell.LogEvent 2, "Warning: Memory usage is at " & _
            FormatNumber(MemoryUsagePercent, 2) & "%"
    Else
        objShell.LogEvent 4, "Information: Memory usage is at " & _
            FormatNumber(MemoryUsagePercent, 2) & "%"
    End If
    
    If Err.Number <> 0 Then
        objShell.LogEvent 1, "Error checking memory: " & Err.Description
        Err.Clear
    End If
    
    On Error GoTo 0
End Sub

Sub CheckServices()
    On Error Resume Next
    
    ' Define critical services to monitor
    arrCriticalServices = Array("wuauserv", "spooler", "lanmanserver", "dnscache")
    
    For Each strService In arrCriticalServices
        Set colServices = objWMIService.ExecQuery( _
            "SELECT * FROM Win32_Service WHERE Name = '" & strService & "'")
        
        For Each objService In colServices
            If objService.State <> "Running" Then
                objShell.LogEvent 2, "Warning: Critical service " & objService.Name & _
                    " is not running. State: " & objService.State
            End If
        Next
    Next
    
    If Err.Number <> 0 Then
        objShell.LogEvent 1, "Error checking services: " & Err.Description
        Err.Clear
    End If
    
    On Error GoTo 0
End Sub

This comprehensive monitoring script checks disk space, memory usage, and critical service status, logging appropriate events based on the severity of any issues detected.

Conclusion

Integrating event logging into your VBScript programs is a powerful way to monitor system activities, track script execution, and maintain an audit trail of important events. By understanding the LogEvent method and different event types, you can create robust scripts that provide valuable insights into system behavior and help troubleshoot issues effectively.

As you become more comfortable with VBScript event logging integration, you'll discover numerous ways to enhance your system administration tasks, automate monitoring processes, and improve the reliability of your scripts. The ability to log events directly to the Windows Event Log makes VBScript an even more valuable tool for system administrators and power users.

Now that you've learned the basics of VBScript event logging integration, try experimenting with different types of events, monitoring various system components, and incorporating event logging into your existing scripts. With practice, you'll develop the skills to create sophisticated monitoring and automation solutions that leverage the full power of VBScript and the Windows Event Log system.

Frequently Asked Questions

• What is VBScript event logging?
  VBScript event logging is the process of writing script activities to the Windows Event Log, allowing administrators to track script execution, monitor system behavior, and maintain audit trails.
• How do I write events to the Windows Event Log using VBScript?
  Use the LogEvent method of the WScript.Shell object. Create the object with CreateObject('WScript.Shell'), then call objShell.LogEvent intType, strMessage where intType is the event type and strMessage is the event text.
• What are the different event types in VBScript?
  VBScript supports various event types including SUCCESS (0), ERROR (1), WARNING (2), INFORMATION (4), AUDIT_SUCCESS (8), and AUDIT_FAILURE (16), each representing different severity levels of events.
• Can I log events to remote computers with VBScript?
  Yes, you can log events to remote computers by specifying the computer name as the third parameter in the LogEvent method: objShell.LogEvent 0, 'Message', 'RemoteComputerName'.
• What are best practices for VBScript event logging?
  Use descriptive messages, include timestamps when needed, use consistent event types, avoid logging sensitive information, implement error handling, and consider performance implications when logging frequent events.